Privacy Policy

1. Who we are

PayFlow is operated by Londonra Ltd, a company registered in England and Wales, with its registered office in London, United Kingdom. You can contact us at info@londonra.com.

2. Data we collect

• Account data — email, name, password hash (when you sign in to sync across devices).
• Work-tracking data — shifts, hours, hourly rate, payday, savings preferences that you enter.
• Pay-check data — payslip figures you type in to compare against your tracked shifts. We do not read your payslip or connect to your bank or employer.
• Technical data — device type, browser, IP address, and basic usage events to keep the Service running.
• Communications — messages you send to info@londonra.com.

You can also use PayFlow as a guest, in which case your data is stored only on your device.

3. Lawful bases for processing

• Contract — to provide the Service you signed up for (account, sync, saved shifts).
• Legitimate interests — to keep the Service secure, prevent abuse, and improve product quality.
• Consent — for non-essential cookies, analytics, and any optional marketing communications. You can withdraw consent at any time.
• Legal obligation — where we must retain records to comply with UK law.

4. How we use your data

• Provide the pay-tracking, pay-check and savings features.
• Sync your data across your devices when you sign in.
• Keep the Service secure and diagnose faults.
• Respond to your support enquiries.
• Improve the Service based on aggregated, non-identifying usage patterns.

We do not sell your personal data. We do not use your data to make automated decisions that produce legal or similarly significant effects.

5. Sharing with third parties

We only share data with processors who help us run the Service under written data-processing agreements:

• Hosting and database — Supabase / Cloudflare (Lovable Cloud infrastructure).
• Payments — Stripe, if you subscribe to a paid business plan. PayFlow never sees your card details.
• Email — transactional email providers for account and support messages.

We may disclose data if required by law, a court order, or to protect our rights or the safety of users.

6. International transfers

Some processors may store data outside the UK. Where they do, we rely on UK-approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep your data

• Account and shift data: while your account is active, and up to 12 months after deletion for backup and dispute-resolution purposes.
• Support emails: up to 3 years.
• Anonymised analytics: may be retained indefinitely.

8. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (the “right to be forgotten”).
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, email info@londonra.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We use industry-standard measures including encryption in transit (HTTPS), row-level database security, and restricted staff access. No system is 100% secure — please use a strong, unique password.

10. Cookies

We use a small number of essential and optional cookies. See our Cookie Policy for details.

11. Children

PayFlow is not directed at children under 16 and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the app or email. Continued use of the Service after changes means you accept the updated policy.

13. Contact us

Londonra Ltd, London, United Kingdom.
Email: info@londonra.com